host-checker

Everything, in one place

One tool, the whole triage loop.

Started as a way to stop pasting IPs into ten browser tabs. Turned into a small threat-intel workbench that runs entirely on your side of the wire.

01 15 sources, one verdict

VirusTotal, AbuseIPDB, GreyNoise, URLhaus, ThreatFox, MalwareBazaar, OTX, Shodan, IPinfo, SecurityTrails, Pulsedive, MalShare, RDAP, crt.sh and the Tor exit list — aggregated into one explainable 0–100 score.

02 Every IOC type

IPv4, IPv6, CIDR, domains, URLs, MD5/SHA1/SHA256. Auto-refangs evil[.]com and hxxp:// so you can paste straight from a report.

03 Auto-pivot

Check a domain and it follows the DNS to the resolved IPs and checks those too — catching the "clean domain, dirty IP" case automatically.

04 Three ways in

Same engine behind hostchecker check for scripts and CI, a JSON HTTP API for automation, and an interactive web UI for live triage.

05 MISP & STIX export

One click (or one flag) to a MISP event or a STIX 2.1 bundle with deterministic indicator IDs. Drop it straight into your platform.

06 Compare & recall

The web UI keeps a local history of recent checks and lets you put IOCs side by side in a matrix to see exactly where the sources disagree.

07 Knows its own health

hostchecker doctor probes every source live with your keys and tells you what actually works — no more silent "this provider returned nothing".

08 Paranoid mode

One toggle for live-infrastructure work: query only passive intel databases, never resolve or scan the IOC, never tip off the target. Runs locally against your own keys; a local allowlist keeps your own infrastructure off third-party servers entirely.

In action

The CLI and the web UI.

Colour-coded verdicts, per-provider breakdowns, pivoted IPs — at the terminal or in the browser.

$ hostchecker check 8.8.8.8 evil[.]com bad-domain.test

host-checker web UI demo: type IOCs, get results, compare side by side

The web UI — type IOCs, get one verdict from every source, then flip to a side-by-side comparison. Filter, sort, and export to JSON / MISP / STIX.

Sources

15 sources. Bring your own keys.

The four ● work with no registration at all. The rest unlock as you add keys — every one has a free tier.

tor_exit crtsh rdap ipinfo virustotal abuseipdb greynoise urlhaus threatfox malwarebazaar otx shodan securitytrails pulsedive malshare

How it started

It began as a tab problem.

analyst@soc — ~/triage

$ # 12 IPs from an alert. open VT, AbuseIPDB, GreyNoise, Shodan…

$ # …for each one. by hand. again.

there has to be a better way.

$ hostchecker check 12 IPs → one table, one score, 0.6s

Why it exists

Triage shouldn't mean ten browser tabs.

Every IOC lookup tool I reached for was either a hosted service that wanted my indicators on someone else's server, or a single-source CLI that only answered half the question. Checking one IP meant a dozen tabs and a mental note to remember which source said what.

So host-checker got built piece by piece: one query, many sources, one verdict you can explain — and all of it running locally, so the things you're investigating never leave your machine. The more sources it learned to ask, the less the browser-tab ritual made sense.

It's open source and MIT licensed. No hosted tier, no account, no catch. If you want to point it at paid APIs you have keys for, great. If you want to run it entirely on the free, keyless sources, that works too.

Get started

It's yours.

Install from PyPI and run your first check in under a minute.

$ pip install ioc-hostchecker && hostchecker check 8.8.8.8 evil[.]com

View on PyPI View on GitHub

Prefer Docker? docker run -p 8000:8000 ghcr.io/kukitzz/host-checker:latest
Python 3.11+ · MIT licensed · see the README for keys and config.